[RISCV] Use after free in gas/config/tc-riscv.c: riscv_set_arch()

[Andrew Waterman]

Hi Klaus,

Thanks for pointing this out.  We'll submit a patch shortly, tail between legs.

Andrew

On Tue, Jul 25, 2017 at 9:48 PM, Klaus Kruse Pedersen (Klaus)
<klauskpedersen@rdamicro.com> wrote:
>
>
> The code below will pass a pointer to a free'd string to as_fatal()
> when more than one extension is been specified:
>
>  151 const char *extension = NULL;
> [...]
>  187   while (*p)
>  188     {
>  189       if (*p == 'x')
>  190         {
>  191           char *subset = xstrdup (p), *q = subset;
>  192
>  193           while (*++q != '\0' && *q != '_')
>  194             ;
>  195           *q = '\0';
>  196
>  197           if (extension)
>  198             as_fatal ("-march=%s: only one non-standard extension
> is supported"
>  199                       " (found `%s' and `%s')", s, extension,
> subset);
>
> Problem is here:
>
>  200           extension = subset;
>  201           riscv_add_subset (subset);
>  202           p += strlen (subset);
>  203           free (subset);
>  204         }
> [...]
>
> https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;a=blob;f=gas/c
> onfig/tc-
> riscv.c;h=55c41c5db3c9240e8da3cdf8906cfb745d041c6f;hb=HEAD#l187